Merge commit '067432c1c95882c7221e694f33d9f3bdbe46de7f'
authorMichael Niedermayer <michaelni@gmx.at>
Sun, 24 Feb 2013 11:57:08 +0000 (12:57 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Sun, 24 Feb 2013 12:08:42 +0000 (13:08 +0100)
* commit '067432c1c95882c7221e694f33d9f3bdbe46de7f':
  loco: check that there is data left after decoding a plane.
  lagarith: avoid infinite loop in lag_rac_refill()

Conflicts:
libavcodec/loco.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavcodec/lagarithrac.h
libavcodec/loco.c

Simple merge
@@@ -189,10 -186,6 +189,10 @@@ static int decode_frame(AVCodecContext 
      }
      p->key_frame = 1;
  
-     if (decoded < 0) goto stop; \
 +#define ADVANCE_BY_DECODED do { \
++    if (decoded < 0 || decoded >= buf_size) goto buf_too_small; \
 +    buf += decoded; buf_size -= decoded; \
 +} while(0)
      switch(l->mode) {
      case LOCO_CYUY2: case LOCO_YUY2: case LOCO_UYVY:
          decoded = loco_decode_plane(l, p->data[0], avctx->width, avctx->height,
          decoded = loco_decode_plane(l, p->data[0] + p->linesize[0]*(avctx->height-1) + 2, avctx->width, avctx->height,
                                      -p->linesize[0], buf, buf_size, 3);
          break;
-     case LOCO_CRGBA: case LOCO_RGBA:
++    case LOCO_CRGBA:
+     case LOCO_RGBA:
 -        decoded = loco_decode_plane(l, p->data[0], avctx->width, avctx->height,
 -                                    p->linesize[0], buf, buf_size, 4);
 -        if (decoded >= buf_size)
 -            goto buf_too_small;
 -        buf += decoded; buf_size -= decoded;
 -
 -        decoded = loco_decode_plane(l, p->data[0] + 1, avctx->width, avctx->height,
 -                                    p->linesize[0], buf, buf_size, 4);
 -        if (decoded >= buf_size)
 -            goto buf_too_small;
 -        buf += decoded; buf_size -= decoded;
 -
 -        decoded = loco_decode_plane(l, p->data[0] + 2, avctx->width, avctx->height,
 -                                    p->linesize[0], buf, buf_size, 4);
 -        if (decoded >= buf_size)
 -            goto buf_too_small;
 -        buf += decoded; buf_size -= decoded;
 -
 -        decoded = loco_decode_plane(l, p->data[0] + 3, avctx->width, avctx->height,
 -                                    p->linesize[0], buf, buf_size, 4);
 +        decoded = loco_decode_plane(l, p->data[0] + p->linesize[0]*(avctx->height-1), avctx->width, avctx->height,
 +                                    -p->linesize[0], buf, buf_size, 4);
 +        ADVANCE_BY_DECODED;
 +        decoded = loco_decode_plane(l, p->data[0] + p->linesize[0]*(avctx->height-1) + 1, avctx->width, avctx->height,
 +                                    -p->linesize[0], buf, buf_size, 4);
 +        ADVANCE_BY_DECODED;
 +        decoded = loco_decode_plane(l, p->data[0] + p->linesize[0]*(avctx->height-1) + 2, avctx->width, avctx->height,
 +                                    -p->linesize[0], buf, buf_size, 4);
 +        ADVANCE_BY_DECODED;
 +        decoded = loco_decode_plane(l, p->data[0] + p->linesize[0]*(avctx->height-1) + 3, avctx->width, avctx->height,
 +                                    -p->linesize[0], buf, buf_size, 4);
          break;
      }
- stop:
  
      *got_frame      = 1;
      *(AVFrame*)data = l->pic;
  
 -    return buf_size;
 +    return buf_size < 0 ? -1 : avpkt->size - buf_size;
+ buf_too_small:
+     av_log(avctx, AV_LOG_ERROR, "Input data too small.\n");
+     return AVERROR(EINVAL);
  }
  
  static av_cold int decode_init(AVCodecContext *avctx)